index

signapk

signapk is a free cross-platform standalone tool to sign the Android APK file, it's written in C/C++ and has compatible command line arguments with Google ApkSigner.

signapk is implemented from scratch in C/C++ according to ApkSigner docs and source code, because there are many factors involved in APK signing. If you have problems with the signature, please submit an issue at https://github.com/dvdforge/signapk/issues.

Download

signapk version 1.5 (2023-12-15)

  • signapk for Windows
    • signapk x86
    • signapk x64
    • signapk ARM64
  • signapk for macOS
  • signapk for Linux (Unbuntu)

Features

  • Written in C/C++, with no third-party dependencies
  • Native binaries for Windows(x86/x64/ARM64), macOS(x86_64/ARM64) and Linux(Unbuntu)
  • Compatible command line arguments with ApkSigner
  • Support APK Signature Scheme v1
  • Support APK Signature Scheme v2
  • Support APK Signature Scheme v3

Todo

  • Loading PKCS#12 keystore
  • Support APK Signature Scheme v4
  • Verify APK Signature Scheme v1


Changelog

Version 2.0 2023-12-15

  • Changed: implement complatible command line arguments with ApkSigner
  • Added: support signature algorithm DSA-1024, DSA-2048 and DSA-3072
  • Added: native binaries for macOS (x86-x64 and ARM64)
  • Added: native binaries for Linux (Unbuntu)

Version 1.0 2023-06-01

  • First public release


Example

Sign the in.apk with signing scheme v1/v2/v3, output to out.apk

signapk sign --ks rsa_1024.jks --ks-pass pass:android --key-pass pass:android --v1-signing-enabled true --v2-signing-enabled true --v3-signing-enabled true --out out.apk in.apk

Verify app.apk

signapk verify --verbose app.apk


usage

signapk usage

signapk <command> [options]

Command | Description
sign | Sign the provided APK
verify | Check whether the provided APK is expected to verify on Android
Options | Description
--ks | KeyStore file
--ks-key-alias | KeyStore key alias
--ks-pass | KeyStore password
--key-pass | Key password
--in | Input file
--out | Output file
--help -h | Help
--verbose -v | Verbose output
--v1-signing-enabled | Whether to enable signing using APK Signature Scheme v1
--v2-signing-enabled | Whether to enable signing using APK Signature Scheme v2
--v3-signing-enabled | Whether to enable signing using APK Signature Scheme v3
--min-sdk-version | Lowest API Level
--max-sdk-version | Highest API Level

Example

signapk sign --ks release.jks app.apk
signapk verify --verbose app.apk


--help

Show help about this command and exit


--in

Input APK file to sign. This is an alternative to specifying the APK as the very last parameter, after all options. Unless --out is specified, this file will be overwritten with the resulting signed APK.


--key-pass

Password with which the private key is protected. The following formats are supported:

pass:<password> password provided inline
env:<name>      password provided in the named
                environment variable
file:<file>     password provided in the named
                file, as a single line
stdin           password provided on standard input,
                as a single line

If --key-pass is not specified for a KeyStore key, this tool will attempt to load the key using the KeyStore password and, if that fails, will prompt for key password and attempt to load the key using that password.

If --key-pass is not specified for a private key file key, this tool will prompt for key password only if a password is required.

When the same file (including standard input) is used for providing multiple passwords, the passwords are read from the file one line at a time. Passwords are read in the order in which signers are specified and, within each signer, KeyStore password is read before the key password is read.


--ks-key-alias

Alias under which the private key and certificate are stored in the KeyStore. This must be specified if the KeyStore contains multiple keys.


--ks-pass

KeyStore password (see --ks). The following formats are supported:

pass:<password> password provided inline
env:<name>      password provided in the named
                environment variable
file:<file>     password provided in the named
                file, as a single line
stdin           password provided on standard input,
                as a single line

A password is required to open a KeyStore.

By default, the tool will prompt for password via console or standard input.

When the same file (including standard input) is used for providing multiple passwords, the passwords are read from the file one line at a time. Passwords are read in the order in which signers are specified and, within each signer, KeyStore password is read before the key password is read.


--ks

Load private key and certificate chain from the Java KeyStore initialized from the specified file.


--max-sdk-version

Highest API Level on which this APK's signatures will be verified. By default, the highest possible value is used.


--min-sdk-version

Lowest API Level on which this APK's signatures will be verified. By default, the value from AndroidManifest.xml is used. The higher the value, the stronger security parameters are used when signing.


--out

File into which to output the signed APK. By default, the APK is signed in-place, overwriting the input file.


--v1-signing-enabled

Whether to enable signing using JAR signing scheme (aka v1 signing scheme) used in Android since day one. By default, signing using this scheme is enabled based on min and max SDK version (see --min-sdk-version and --max-sdk-version).


--v2-signing-enabled

Whether to enable signing using APK Signature Scheme v2 (aka v2 signing scheme) introduced in Android Nougat, API Level 24. By default, signing using this scheme is enabled based on min and max SDK version (see --min-sdk-version and --max-sdk-version).


--v3-signing-enabled

Whether to enable signing using APK Signature Scheme v3 (aka v3 signing scheme) introduced in Android P, API Level 28. By default, signing using this scheme is enabled based on min and max SDK version (see --min-sdk-version and --max-sdk-version). Multiple signers are not supported when using v3 signing, but multiple signers may be provided in conjunction with the "lineage" option to make sure that the app is signed by an appropriate signer on all supported platform versions.


--verbose

Verbose output mode


-h

Show help about this command and exit


-v

Verbose output mode